<format>
  <id company="F-Secure" name="CTRACE" />
  <description>Logs that are created with macros from common F-Secure tracing module trace.h/trace.cpp.</description>
  <regular-grammar>
    <patterns>
      <pattern>*.log</pattern>
      <pattern>*.apl</pattern>
    </patterns>
    <encoding>ACP</encoding>
    <head-re><![CDATA[^ # every log line starts with newline
((?<sev>\d)\t)? # single-digit severity
((?<thread>[0-9a-fA-F]+)\t)? # there might be thread id (hex number)
(?<date>[\ \d]{2}\/\d{2}\/\d{2} # year, month, day
\ \d{2}\:\d{2}\:\d{2})\t # hour, minute, seconds]]></head-re>
    <body-re><![CDATA[^
((?<ticks>[0-9A-F]{8})\t)?
(\s*(?<type>[\{\}]))?
(?<body>.*)
$]]></body-re>
    <fields-config>
      <field name="Time">TO_DATETIME(date.Trim(), "y/MM/dd HH:mm:ss")</field>
      <field name="Thread">thread</field>
      <field name="Body">body</field>
      <field name="Severity" code-type="function"><![CDATA[switch (sev)
{
case "2":
	return Severity.Warning;
case "3":
	return Severity.Error;
default:
	return Severity.Info;
}]]></field>
      <field name="EntryType" code-type="function"><![CDATA[switch (type)
{
case "{":
	return EntryType.FrameBegin;
case "}":
	return EntryType.FrameEnd;
default:
	return EntryType.Content;
}]]></field>
    </fields-config>
  </regular-grammar>
</format>